I was able to pull the checkpoint cert and verified communication son the checkpoint side.
Log grabber is trying to execute as seen in splunkd.log but is reporting the following prolems:
04-06-2013 14:24:50.718 -0500 INFO TcpOutputProc - Connected to idx=192.168.120.52:9997
04-06-2013 14:24:56.285 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:24:56.949 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:24:57.853 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:06.813 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:07.646 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:08.582 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:18.484 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:19.352 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:20.628 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached.
04-06-2013 14:25:20.739 -0500 INFO TcpOutputProc - Connected to idx=192.168.120.51:9997
Does anyone have any insight?
The fix for this problem is to create a home directory for the splunk account. Make sure you create it and set the appropriate permissions.
# mkdir /home/splunk
# chown splunk /home/splunk/
# chgrp splunk /home/splunk/
Then restart splunk.
Can you verify that the user that Splunk is running as has a home directory and can write to it?